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Today,  David  M.  Walker,  Comptroller  General  of  the  United  States  and  head  of  the 
General  Accounting  Office  (GAO),  announced  significant  changes  to  the  auditor 
independence  requirements  under  Government  Auditing  Standards.  These  standards, 
which  were  first  pubhshed  in  1972  and  are  commonly  referred  to  as  the  “Yellow 
Book,”  cover  federal  entities  and  those  organizations  receiving  federal  funds.  Various 
laws  require  compliance  with  the  Comptroller  General’s  auditing  standards  in 
connection  with  audits  of  federal  entities  and  funds.  Furthermore,  many  states  and 
local  governments  and  other  entities,  both  domestically  and  internationally,  have 
voluntarily  adopted  these  standards. 

While  the  new  standard  deals  with  a  range  of  auditor  independence  issues,  the  most 
significant  change  relates  to  the  rules  associated  with  nonaudit,  or  consulting 
services.  Auditors  have  the  capability  of  performing  a  range  of  services  for  their 
cUents.  However,  in  some  circumstances  it  is  not  appropriate  for  them  to  perform 
both  audit  and  certain  nonaudit  services  for  the  same  client.  In  these  circumstances, 
the  auditor  and/or  their  client  will  have  to  make  a  choice  as  to  which  of  these 
services  they  will  provide. 

The  focus  of  the  changes  to  the  auditor  independence  standard  is  to  better  serve  the 
public  interest  and  to  maintain  a  high  degree  of  integrity,  objectivity,  and 
independence  for  audits  of  government  entities.  The  standard  includes  a  principle- 
based  approach  to  addressing  this  issue  supplemented  with  certain  safeguards.  The 
new  independence  standard  for  nonaudit  services  is  based  on  two  overarching 
principles: 

•  Auditors  should  not  perform  management  functions  or  make  management 
decisions;  and 

•  Auditors  should  not  audit  their  own  work  or  provide  non-audit  services  in 
situations  where  the  amounts  or  services  involved  are  significanUmaterial  to  the 
subject  matter  of  the  audit. 

For  nonaudit  services  that  do  not  violate  the  above  principles,  certain  supplemental 
safeguards  would  have  to  be  met.  For  example:  (1)  personnel  who  perform  nonaudit 
services  would  be  precluded  from  performing  any  related  audit  work,  (2)  the 
auditor’s  work  could  not  be  reduced  beyond  the  level  that  would  be  appropriate  if  the 
nonaudit  work  was  performed  by  another  unrelated  party;  and  (3)  certain 
documentation  and  quality  assurance  requirements  must  be  met. 
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The  new  standard  includes  an  express  prohibition  regarding  auditors  providing 
certain  bookkeeping/recordkeeping  services,  and  limits  payroll  processing  and 
certain  other  services,  all  of  which  are  presently  permitted  under  auditing  standards 
of  the  American  Institute  of  Certified  Public  Accountants  (AICPA).  At  the  same  time, 
the  standard  recognizes  that  auditors  can  provide  routine  advice  and  answer 
technical  questions  without  violating  these  two  principles  or  having  to  comply  with 
the  supplemental  safeguards.  The  standard  also  provides  examples  of  how  certain 
services  would  be  treated  under  the  new  rules. 

The  revisions  contained  in  the  new  standard  have  gone  through  an  extensive 
deliberative  process  over  the  past  3  years,  including  extensive  public  comments  and 
input  from  the  Comptroller  General's  Advisory  Council  on  Government  Auditing 
Standards.  The  Council  includes  20  experts  in  financial  and  performance  auditing 
and  reporting  drawn  from  all  levels  of  government,  academia,  private  enterprise,  and 
public  accounting,  who  advise  the  Comptroller  General  on  Government  Auditing 
Standards. 

The  GAO  received  extensive  comments  from  the  AICPA  and  individual  members  of 
the  public  accounting  profession.  Many  of  these  comments  related  to  activities  by 
small  CPA  firms.  Their  concerns  centered  on  the  fact  that  the  new  standards  for 
nonaudit  services  would  be  inconsistent  with  the  current  practices  permitted  under 
AICPA  independence  rules  and  could  cause  a  hardship  on  the  auditors  and 
management  of  audited  entities  that  receive  nonaudit  services.  The  views  of  aU 
parties  that  formally  commented  on  an  exposure  draft  of  the  new  standards  were 
thoroughly  considered  by  the  Comptroller  General  in  making  this  decision. 

In  the  final  analysis,  protecting  the  public  interest  and  ensuring  public  confidence  in 
the  independence  of  auditors  of  government  financial  statements,  programs,  and 
operations,  both  in  form  and  substance,  were  the  overriding  considerations  in  the 
Comptroller  General's  decision  to  adopt  these  new  standards  for  nonaudit  services. 
According  to  Comptroller  General  David  M.  Walker,  “This  standard  represents  an 
important  step  to  enhance  the  independence  of  external  auditors  and  better  protect 
the  public.  It  is  our  hope  that  the  AICPA  will  raise  its  independence  standards  to 
those  contained  in  this  new  standard  in  order  to  eliminate  any  inconsistency  between 
this  standard  and  their  current  standards.” 

According  to  Comptroller  General  Walker,  this  new  standard  is  the  first  of  several 
planned  steps  in  connection  with  nonaudit  services  covered  by  the  Yellow  Book. 

For  example,  the  Comptroller  General  plans  to  work  with  the  Federal  Accounting 
Standards  Advisory  Board,  which  develops  generally  accepted  accounting  principles 
for  the  federal  government,  to  determine  what  type  of  additional  disclosures  relating 
to  nonaudit  services  may  be  appropriate.  In  addition.  Comptroller  General  Walker 
has  asked  his  Advisory  Council  on  Government  Auditing  Standards  to  review  and 
monitor  this  area  to  determine  what,  if  any,  additional  steps  may  be  appropriate. 

In  a  separate  but  related  matter.  Comptroller  General  David  M.  Walker,  Secretary  of 
the  Treasury  Paul  H.  O’Neill,  Office  of  Management  and  Budget  Director  Mitchell  E. 
Daniels  and  Office  of  Persormel  Management  Director  Kay  Coles  James,  who 
comprise  the  Principals  of  the  Joint  Financial  Management  Improvement  Program, 
have  agreed  that  the  24  major  departments  and  agencies  covered  by  the  Chief 
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Financial  Officers  Act  should  have  audit  committees.  The  scope,  structure  and 
timing  of  this  new  requirement  will  be  determined  over  the  next  several  months.  This 
will  include  determining  what  role  these  audit  committees  might  play  in  connection 
with  nonaudit  services. 

Because  of  the  breadth  of  changes  in  the  new  standards,  they  are  applicable  to  all 
audits  for  periods  beginning  on  or  after  October  1, 2002.  However,  early 
implementation  is  encouraged. 

The  new  audit  standard  is  available  on  GAO’s  web  site  at 
http://www.  gao.  gov/govaud/vbkO  1  .htm. 
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INDEPENDENCE 


3.11  The  second  general  standard  is: 

In  all  matters  relating  to  the  audit  work,  the  audit  organization  and  the 
individual  auditor,  whether  government  or  public,  should  be  free  both  in 
fact  and  appearance  from  personal,  external,  and  organizational 
impairments  to  independence. 

3.12  Auditors  and  audit  organizations  have  a  responsibility  to  maintain 
independence,  so  that  opinions,  conclusions,  judgments,  and  recommendations  wiQ 
be  impartial  and  will  be  viewed  as  impartial  by  knowledgeable  third  parties.  An 
auditor  should  avoid  situations  that  could  lead  reasonable  third  parties  with 
knowledge  of  the  relevant  facts  and  circumstances  to  conclude  that  the  auditor  is  not 
able  to  maintain  independence  and,  thus,  is  not  capable  of  exercising  objective  and 
impartial  judgment  on  aU  issues  associated  with  conducting  and  reporting  on  the 
work. 

3.13  Auditors  need  to  consider  three  general  classes  of  impairments  to 
independence — ^personal,  external,  and  organizational.  ‘  If  one  or  more  of  these 
impairments  affects  an  auditor’s  capability  to  perform  the  work  and  report  results 
impartially,  that  auditor  should  either  decline  to  perform  the  work,  or  in  those 
situations  in  which  the  government  auditor  because  of  a  legislative  requirement  or  for 
other  reasons  cannot  decline  to  perform  the  work,  the  impairment(s)  should  be 
reported  in  the  scope  section  of  the  audit 

3.14  In  using  the  work  of  a  specialist,^  auditors  need  to  consider  the  specialist  as  a 
member  of  the  audit  team  and,  accordingly,  assess  the  specialist’s  capability  to 
perform  the  work  and  report  results  impartially.  In  conducting  this  assessment, 
auditors  should  provide  the  specialist  with  the  GAGAS  independence  requirements 
and  obtain  representations  from  the  specialist  regarding  their  independence  from  the 
activity  or  program  under  audit.  If  the  specialist  has  an  impairment  to  independence, 
the  auditor  should  not  use  the  work  of  that  specialist. 

Personal  Impairments 

3.15  The  audit  organization  should  have  an  internal  quality  control  system  to  help 
determine  if  auditors  have  any  personal  impairments  to  independence  that  could 
affect  their  impartiality  or  the  appearance  of  impartiality.  The  audit  organization 
needs  to  be  alert  for  personal  impairments  to  independence  of  its  staff  members. 
Personal  impairments  of  staff  members  result  from  relationships  and  beliefs  that 
might  cause  an  auditor  to  limit  the  extent  of  the  inquiry,  limit  disclosure,  or  weaken 


'Nongovernment  auditors  should  also  follow  the  AICPA  code  of  professional  conduct  and 

the  code  of  professional  conduct  of  the  state  board  with  jurisdiction  over  the  practice  of  the  public 

accountant  and  the  audit  organization. 

^Specialists  to  whom  this  section  applies  include,  but  are  not  limited  to,  actuaries,  appraisers, 
attorneys,  engineers,  environmental  consultants,  medical  professionals,  statisticians,  and  geologists. 
This  section  also  applies  to  external  consultants  and  firms  performing  work  for  the  audit  orgamzation. 
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or  slant  audit  findings  in  any  way.  Auditors  are  responsible  for  notifying  the 
appropriate  officials  within  their  audit  organizations  if  they  have  any  personal 
impairments  to  independence.  Examples  of  personal  impairments  of  individual 
auditors  include,  but  are  not  limited  to,  the  following: 

a.  immediate  family  or  close  family  member®  who  is  a  director  or  officer  of  the 
audited  entity,  or  as  an  employee  of  the  audited  entity,  is  in  a  position  to  exert  direct 
and  significant  influence  over  the  entity  or  the  program  under  audit, 

b.  financial  interest  that  is  direct,  or  is  significant/material  though  indirect,  in  the 
audited  entity  or  program, 

c.  responsibility  for  managing  an  entity  or  decision-making  that  could  affect 
operations  of  the  entity  or  program  being  audited,  for  example  as  a  director,  officer, 
or  other  senior  position  of  the  entity,  activity,  or  program  being  audited,  or  as  a 
member  of  management  in  any  decision-making,  supervisory,  or  ongoing  monitoring 
function  for  the  entity,  activity,  or  program  under  audit,^  ® 

d.  concmrent  or  subsequent  performance  of  an  audit  by  the  same  individual  who 
maintained  the  official  accounting  records  when  such  services  involved  preparing 
source  documents  or  originating  data,  in  electronic  or  other  form;  posting 
transactions  (whether  coded  by  management  or  not  coded);  authorizing,  executing, 
or  consummating  transactions  (for  example,  approving  invoices,  payrolls,  claims,  or 
other  payments  of  the  entity  or  program  being  audited),  maintaining  an  entity’s  bank 
account  or  otherwise  having  custody  of  the  audited  entity’s  funds;  or  otherwise 
exercising  authority  on  behalf  of  the  entity,  or  having  authority  to  do  so,  * 

e.  preconceived  ideas  toward  individuals,  groups,  organizations,  or  objectives  of  a 
particular  program  that  could  bias  the  audit, 

f.  biases,  including  those  induced  by  political  or  social  convictions,  that  result  from 
employment  in,  or  loyalty  to,  a  particular  group,  organization,  or  level  of  government, 
and 

g.  seeking  employment  with  an  audited  organization  during  the  conduct  of  the  audit. 


’Immediate  family  member  is  a  spouse,  spouse  equivalent,  or  dependent  (whether  or  not  related).  A 
close  family  member  is  a  parent,  sibling,  or  nondependent  child. 

^If  the  auditor  has  performed  nonaudit  services  for  a  client  that  affect  information  that  is  the  subject  of 
the  audit  and  management  is  unable  or  unwilling  to  take  responsibility  for  this  information,  the  risk 
that  the  auditor  may  be  perceived  to  have  a  personal  impairment  to  independence  is  increased.  See 
paragraphs  3.18  through  3.26  for  additional  guidance  on  impairments  to  independence  associated  with 
the  scope  of  services  that  may  be  provided  by  audit  organizations  to  entities  they  audit. 

“The  auditor  needs  to  be  free  from  this  personal  impairment  for  the  period  covered  by  the  activity 
under  audit,  including  any  financial  statements  being  audited,  and  for  the  period  in  which  the  audit  is 
being  performed  and  reported. 

*See  footnote  5. 
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3.16  Audit  organizations  and  auditors  may  encounter  many  different  circumstances  or 
combination  of  circumstances  that  could  create  a  personal  impairment.  Therefore,  it  is 
impossible  to  identify  every  situation  that  could  result  in  a  personal  impairment. 

Accordingly,  audit  organizations  should  include  as  part  of  its  internal  quality  control  system 
requirements  to  identify  personal  impairments  and  determine  compliance  with  GAGAS 
independence  requirements.  At  a  minimum,  audit  organizations  should: 

a.  establish  policies  and  procedures  that  will  enable  the  identification  of  personal 
impairments  to  independence,  including  whether  performing  nonaudit  services  affects  the 
subject  matter  of  audits  and  applying  safeguards  to  appropriately  reduce  that  risk,  (See 
paragraphs  3.20  through  3.26.) 

b.  communicate  the  audit  organization’s  policies  and  procedures  to  all  auditors  in  the 
organization  and  ensure  understanding  of  requirements  through  training  or  other  means  such 
as  auditors  acknowledging  their  understanding  periodically, 

c.  establish  internal  policies  and  procedures  to  monitor  compliance  with  the  audit 
organization’s  policies  and  procedures, 

d.  establish  a  disciplinary  mechanism  to  promote  compliance  with  the  audit  organization’s 
policies  and  procedures,  and 

e.  stress  the  importance  of  independence  and  the  expectation  that  auditors  will  always  act  in 
the  public  interest. 

3.17  When  the  audit  organization  identifies  a  personal  impairment  to  independence,  the 
impairment  needs  to  be  resolved  in  a  timely  manner.  In  situations  where  the  personal 
impairment  is  applicable  only  to  an  individual  auditor  on  a  particular  assignment,  the  audit 
organization  may  be  able  to  mitigate  the  personal  impairment  by  requiring  the  auditor  to 
eliminate  the  personal  impairment.  For  example,  the  auditor  could  sell  a  financial  interest 
that  created  the  personal  impairment,  or  the  audit  organization  could  remove  that  auditor 
from  any  work  on  that  audit  assignment.’  If  the  personal  impairment  cannot  be  mitigated 
through  these  means,  the  audit  organization  needs  to  withdraw  from  the  audit.  In  situations 
in  which  government  auditors  cannot  withdraw  from  the  audit,  they  should  follow  the 
requirements  in  paragraph  3.13. 

3.18  Audit  organizations  that  provide  other  professional  services  (nonaudit  services)  should 
consider  whether  providing  these  services  creates  a  personal  impairment  either  in  fact  or 
appearance  that  adversely  affects  their  independence  for  conducting  audits. 

3.19  Nonaudit  services  generally  differ  from  financial  audits,  attestation  engagements,  and 
performance  audits  described  in  chapter  2  in  that  auditors  may  (1)  perform  tasks  requested  by 
management  that  directly  support  the  entity’s  operations,  such  as  developing  or 


’’Auditors  participating  in  the  audit  assignment,  including  those  who  perform  review  of  the  report,  and 
aU  others  within  the  audit  organization  who  can  directly  influence  the  outcome  of  the  audit,  need  to  be 
free  from  personal  impairments. 
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implementing  accounting  systems;  determining  account  balances;^  developing  internal 
control  systems;  establishing  capitalization  criteria;  processing  payroll;  posting  of 
transactions;  evaluating  assets;  designing  or  implementing  information  technology  or  other 
system;  or  performing  actuarial  studies,  or  (2)  provide  information  or  data  to  a  requesting 
party  without  providing  verification,  analysis,  or  evaluation  of  the  information  or  data,  and 
therefore  the  work  does  not  usually  provide  a  basis  for  conclusions,  recommendations,  or 
opinions  on  the  information  or  data.  These  other  services  may  or  may  not  result  in  a  report. 

In  the  case  of  nongovernment  auditors  that  perform  audits  of  government  entities  under 
GAGAS,  the  term  nonaudit  services  is  synonymous  with  consulting  services. 

3.20  Audit  organizations  have  the  capability  of  performing  a  range  of  services  for  their 
clients.  However,  in  certain  circumstances,  it  is  not  appropriate  for  the  audit  organization  to 
perform  both  audit  and  selected  nonaudit  services  for  the  same  client.  In  these 
circumstances,  the  auditor  and/or  the  audited  entity  will  have  to  make  a  choice  as  to  which  of 
these  services  the  audit  organization  will  provide.  GAGAS  recognize  that  nonaudit  services 
are  provided  by  audit  organizations  and  that  care  needs  to  be  taken  to  avoid  situations  that 
can  impair  auditor  independence,  either  in  fact  or  appearance,  to  provide  financial  audits, 
attestations  engagements,  or  performance  audits  in  accordance  with  GAGAS. 

3.21  Before  an  audit  organization  agrees  to  perform  nonaudit  services,  it  should  carefully 
consider  the  requirements  of  paragraph  3.12  that  auditors  should  avoid  situations  that  could 
lead  reasonable  third  parties  with  knowledge  of  the  relevant  facts  and  circumstances  to 
conclude  that  the  auditor  is  not  able  to  maintain  independence  in  conducting  audits.  In 
conducting  the  assessment,  there  are  two  overarching  principles:  (1)  audit  organizations 
should  not  provide  nonaudit  services  that  involve  performing  management  functions  or 
making  management  decisions  and  (2)  audit  organizations  should  not  audit  their  own  work  or 
provide  nonaudit  services  in  situations  where  the  nonaudit  services  are  significant/material  to 
the  subject  matter  of  audits.  If  the  audit  organization  makes  the  determination  that  the 
nonaudit  service  does  not  violate  these  principles,  it  should  comply  with  all  the  safeguards 
stated  in  paragraph  3.25. 

3.22  Audit  organizations  should  not  perform  management  functions  or  make  management 
decisions.  Performing  management  fonctions  or  making  management  decisions  creates  a 
situation  that  impairs  the  audit  organization’s  independence,  both  in  fact  and  in  appearance, 
to  perform  audits  of  that  subject  matter  and  may  affect  the  audit  organization’s  independence 
to  conduct  audits  of  related  subject  matter.  For  example,  auditors  should  not  serve  as 
members  of  an  entity’s  management  committee  or  board  of  directors,  make  policy  decisions 
that  affect  future  direction  and  operation  of  an  entity’s  programs,  supervise  entity  employees, 
develop  programmatic  policy,  authorize  an  entity’s  transactions,  or  maintain  custody  of  an 
entity’s  assets.^ 

3.23  Auditors  may  participate  on  committees  or  task  forces  in  a  purely  advisory  capacity  to 
advise  entity  management  on  issues  related  to  the  knowledge  and  skills  of  the  auditors 


®The  determination  of  account  balances  is  used  by  management  to  prepare  financial  statements,  such 
as  determining  for  management  the  accounts  receivable  or  accounts  payable  balance  or  the  value  of 
inventory. 

^Entity  assets  are  intended  to  include  all  of  the  entity’s  property  including  bank  accounts,  investment 
accounts,  inventories,  equipment  or  other  assets  owned,  leased,  or  otherwise  in  the  entity’s 
possession. 
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without  impairing  their  independence.  However,  auditors  should  not  make  management 
decisions  or  perform  management  functions.  For  an  example,  auditors  can  provide  routine 
advice  to  the  audited  entity  and  management  to  assist  them  in  activities  such  as  establishing 
internal  controls  or  implementing  audit  recommendations,  can  answer  technical  questions, 
and/or  provide  training.  The  decision  to  follow  the  auditor’s  advice  remains  with 
management  of  the  audited  entity.  These  types  of  interactions  are  normal  between  the 
auditor  and  the  management  of  the  audited  entity  given  the  auditor’s  technical  expertise  and 
the  knowledge  the  auditor  gains  of  the  audited  entity’s  operations.  An  auditor  may  also 
provide  tools  and  methodologies,  such  as  best  practice  guides,  benchmarking  studies,  and 
internal  control  assessment  methodologies  that  can  be  used  by  management.  By  their  very 
nature,  these  are  routine  activities  that  would  not  require  the  audit  organization  to  apply  the 
safeguards  described  in  paragraph  3.25. 

3.24  Audit  organizations  should  not  audit  their  own  work  or  provide  nonaudit 
services  if  the  services  are  significant/material  to  the  subject  matter  of  audits.  In 
considering  whether  the  nonaudit  service  can  have  a  significant  or  material  affect  on 
the  subject  matter  of  audits,  audit  organizations  should  consider  (1)  ongoing  audits, 
(2)  planned  audits,  (3)  requirements  and  commitments  for  providing  audits,  which 
includes  laws,  regulations,  rules,  contracts  and  other  agreements,  and  (4)  policies 
placing  responsibilities  on  the  audit  organization  for  providing  audit  services. 
Government  auditors  generally  have  broad  audit  responsibilities  that  may  extend  to  a 
level  of  government  or  a  particular  entity  within  a  level  of  government.  Given  their 
broad  area  of  audit  responsibility,  government  auditors  need  to  be  especially  careful 
in  providing  nonaudit  services  to  the  entity  so  that  their  independence  is  not  impaired 
to  fulfill  their  full  range  of  audit  responsibilities.  Nongovernment  audit  organizations 
may  provide  audit  and  nonaudit  services  under  contractual  commitments  to  an  entity 
(commonly  referred  to  as  consulting)  and  need  to  consider  whether  nonaudit 
services  they  have  provided  or  are  committed  to  provide  have  a  significant  or 
material  affect  on  the  subject  matter  of  audits. 

3.25  Audit  organizations  may  perform  nonaudit  services  that  do  not  violate  the  principles 
stated  in  paragraph  3.21  only  if  the  audit  organization  and  the  audited  entity  complies  with 
the  following  safeguards.  These  safeguard  would  not  apply  in  connection  with  the  type  of 
routine  activities  described  in  paragraph  3.23.  The  intent  in  paragraph  3.25  is  not  for  the 
audit  organization  to  apply  these  safeguards  to  each  and  every  interaction  it  has  with 
management. 

a.  The  audit  organization  should  document  its  consideration  of  the  nonaudit  services  as 
discussed  in  paragraph  3.21,  including  documentation  for  its  rationale  that  providing  the 
nonaudit  services  does  not  violate  the  two  overarching  principles. 

b.  Before  performing  nonaudit  services,  the  audit  organization  should  establish  and 
document  an  understanding  with  the  audited  entity  regarding  the  objectives,  scope  of  work, 
and  product  or  deliverables  of  the  nonaudit  service.  The  audit  organization  should  also 
establish  and  document  an  understanding  with  management  that  management  is  responsible 
for  the  substantive  outcomes  of  the  work  and,  therefore,  has  a  responsibility  to  be  in  a 
position  in  fact  and  appearance  to  make  an  informed  judgment  on  the  results  of  the  nonaudit 
service  and  that  the  audited  entity  complies  with  the  following; 
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1.  Designates  a  management-level  individual  to  be  responsible  and  accountable  for 
overseeing  the  nonaudit  service. 

2.  Establishes  and  monitors  the  performance  of  the  nonaudit  service  to  ensure  that  it 
meets  management’s  objectives. 

3.  Makes  any  decisions  that  involve  management  functions  related  to  the  nonaudit 
service  and  accepts  fiiU  responsibility  for  such  decisions. 

4.  Evaluates  the  adequacy  of  the  services  performed  and  any  findings  that  result. 

c.  The  audit  organization  should  preclude  personnel  who  provided  the  nonaudit  services 
from  planning,  conducting,  or  reviewing  audit  work  related  to  the  nonaudit  service  under  the 
overarching  principle  that  auditors  cannot  audit  their  own  work. 

d.  The  audit  organization  is  precluded  from  reducing  the  scope  and  extent  of  the  audit  work 
beyond  the  level  that  would  be  appropriate  if  the  nonaudit  work  was  performed  by  another 
unrelated  party. 

e.  The  audit  organization’s  quality  control  systems  for  compliance  with 
independence  requirements  should  include  policies  and  procedures  to  assure 
consideration  of  the  effect  on  the  ongoing,  planned,  and  future  audits  when  deciding 
whether  to  provide  nonaudit  services  and  a  requirement  to  have  the  understanding 
with  management  of  the  audited  entity  documented.  The  understanding  should  be 
commimicated  to  management  in  writing  and  can  be  included  in  the  engagement 
letter.  In  addition,  the  documentation  should  specifically  identify  management’s 
compliance  with  the  elements  discussed  in  paragraph  3.25b,  including  evidence  of  the 
management-level  individual  responsible  for  overseeing  the  nonaudit  service’s 
qualifications  to  conduct  the  required  oversight,  and  that  the  tasks  required  of 
management  were  performed. 

f.  By  their  nature,  certain  nonaudit  services  impair  the  audit  organization’s  ability  to 
meet  either  or  both  of  the  overarching  principles  in  paragraph  3.21  for  certain  types 
of  audit  work.  In  these  cases,  the  audit  organization  should  commumcate  to 
management  of  the  audited  entity  that  the  audit  organization  would  not  be  able  to 
perform  subsequent  audit  work  related  to  the  subject  matter  of  the  nonaudit  service. 
It  should  be  clear  to  management  upfiront  that  the  audit  organization  would  be  in 
violation  of  the  independence  standard  and  that  another  audit  organization  that  met 
the  independence  standard  would  have  to  be  engaged  to  perform  the  audit.  For 
example,  if  the  audit  organization  has  been  responsible  for  designing,  developing, 
and/or  installing  the  entity’s  accounting  system  or  is  operating  the  system  and  then 
performed  a  financial  statement  audit  of  the  entity,  the  audit  organizations  would 
clearly  be  in  violation  of  the  two  overarching  principles  of  the  GAGAS  independence 
standard,  likevvdse,  if  the  audit  organization  developed  an  entity’s  performance 
measurement  system,  the  audit  organization  would  not  be  deemed  independent  if  it 
was  asked  to  conduct  a  performance  audit  to  evaluate  whether  the  system  was 


’Tersonnel  who  provided  the  nonaudit  service  are  permitted  to  convey  the  knowledge  gained  of  the 
audited  entity  and  its  operations  to  the  audit  assignment  team. 
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adequate.  In  both  of  these  examples,  the  audit  organization  could  decide  to  perform 
the  nonaudit  service  but  would  then  not  be  permitted  imder  GAGAS  to  perform  the 
subsequent  audit  because  it  would  be  in  violation  of  one  or  both  of  the  two 
overarching  principles.  It  becomes  a  matter  of  choice  for  the  audit  organization  and 
the  audited  entity.  But  the  audit  organization  cannot  both  provide  the  service  and 
perform  the  audit  if  either  of  the  two  overarching  principles  is  violated. 

g.  For  individual  audits  selected  in  the  peer  review,  all  related  nonaudit  services 
should  be  identified  to  the  audit  organization’s  peer  reviewer  and  the  audit 
documentation  required  by  paragraphs  3.25a  through  e  are  made  available  for 
inclusion  in  the  audit  organization’s  peer  review. 

3.26  Audit  organizations  and  auditors  may  encounter  many  different  circumstances 
or  combinations  of  circumstances;  therefore,  it  is  impossible  to  define  every  situation 
that  could  result  in  an  impairment,  as  discussed  in  paragraph  3.20.  The  following  are 
examples  of  nonaudit  services  performed  by  an  audit  organization  that  typically 
would  not  create  an  impairment  to  the  audit  organization’s  independence  as  long  as 
the  auditor  avoids  situations  that  would  conflict  with  the  two  overarching  principles 
listed  in  paragraph  3.21  and  the  audit  organization  complies  with  the  safeguards  in 
paragraph  3.25. 

a.  Providing  basic  accounting  assistance  limited  to  services  such  as  preparing  draft 
financial  statements  that  are  based  on  management’s  chart  of  accounts  and  trial 
balance  and  any  adjusting,  correcting,  and  closing  entries  that  have  been  approved  by 
management;  preparing  draft  notes  to  the  financial  statements  based  on  information 
determined  and  approved  by  management;  preparing  a  trial  balance  based  on 
management’s  chart  of  accounts;  maintaining  depreciation  schedules  for  which 
management  has  determined  the  method  of  depreciation,  rate  of  depreciation,  and 
salvage  value  of  the  asset.  The  audit  organization,  however,  cannot  maintain  or 
prepare  the  audited  entity’s  basic  accounting  records  or  maintain  or  take 
responsibility  for  basic  financial  or  other  records  that  the  audit  organization  will 
audit."  As  part  of  this  prohibition,  auditors  should  not  post  transactions  (whether 
coded  or  not  coded)  to  the  entity’s  financial  records  or  to  other  records  that 
subsequently  provide  data  to  the  entity’s  financial  records. 

b.  Providing  payroll  services  limited  to  services  such  as  computing  pay  amormts  for 
the  entity’s  employees  based  on  entity  maintained  and  approved  time  records, 
salaries  or  pay  rates,  and  deductions  from  pay;  generating  unsigned  payroll  checks; 
transmitting  client  approved  payroll  to  a  financial  institution  provided  management 
has  approved  the  transmission  and  limited  the  financial  institution  to  make  payments 
only  to  previously  approved  individuals.  In  cases,  where  the  audit  orgamzation  was 
processing  the  entity’s  entire  payroll  and  payroll  was  a  material  amount  to  the  subject 
matter  of  the  audit,  this  would  be  a  violation  of  one  of  the  overarching  principles  in 
paragraph  3.21  and  the  auditor  would  not  be  deemed  independent  under  GAGAS. 


“Proposing  acljusting  and  correcting  entries  that  are  identified  during  the  audit  are  a  routine  byproduct 
of  audit  services  that  are  always  permissible  so  long  as  management  makes  the  decision  on  accepting 
these  entries. 
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c.  Providing  appraisal  or  valuation  services  limited  to  services  such  as  reviewing  the 
work  of  the  entity  or  a  specialist  employed  by  the  entity  where  the  entity  or  specialist 
provides  the  primary  support  for  the  balances  recorded  in  financial  statements  or 
other  information  that  will  be  audited;  valuing  an  entity’s  pension,  other  post¬ 
employment  benefit,  or  similar  liabilities  provided  management  has  determined  and 
taken  responsibility  for  all  significant  assumptions  and  data. 

d.  Preparing  an  entity’s  indirect  cost  proposal’^  or  cost  allocation  plan  provided 
management  has  taken  responsibility  for  all  significant  assumptions  and  data. 

e.  Providing  advisory  services  on  information  technology  limited  to  services  such  as 
advising  on  system  design,  system  installation,  and  system  security  if  management  in 
addition  to  the  safeguards  in  paragraph  3.25  acknowledges  responsibility  for  the 
design,  installation,  and  internal  control  over  the  entity’s  system  and  does  not  rely  on 
the  auditor’s  work  as  the  primary  basis  for  determining  (1)  whether  to  implement  a 
new  system,  (2)  the  adequacy  of  the  new  system  design,  (3)  the  adequacy  of  major 
design  changes  to  an  existing  system,  and  (4)  the  adequacy  of  the  system  to  comply 
with  regulatory  or  other  requirements.  However,  the  audit  organization  should  not 
operate  or  supervise  the  operation  of  the  entity’s  information  technology  system. 

f.  Providing  human  resource  services  to  assist  management  in  its  evaluation  of 
potential  candidates  that  are  limited  to  activities  such  as  serving  on  an  evaluation 
panel  to  review  applications  or  interviewing  candidates  to  provide  input  to 
management  in  arriving  at  a  listing  of  best  qualified  applicants  to  be  provided  to 
management.  The  auditor  should  not  recommend  a  single  individual  for  a  specific 
position  nor  should  the  auditor  conduct  an  executive  search  or  a  recruiting  program 
for  the  audited  entity. 

g.  Preparing  routine  tax  filings  in  accordance  with  federal  tax  laws  and  rules  and 
regulations  of  the  Internal  Revenue  Service  and  state  and  local  tax  authorities  and 
any  applicable  laws. 

h.  Gathering  and  reporting  unverified  external  or  third-party  data  to  aid  legislative 
and  administrative  decision-making. 

i.  Advising  an  entity  regarding  its  performance  of  internal  control  self-assessments. 

j.  Assisting  a  legislative  body  by  developing  questions  for  use  at  a  hearing. 

External  Impairments 

3.27  Factors  external  to  the  audit  organization  may  restrict  the  work  or  interfere  with  an 
auditor’s  ability  to  form  independent  and  objective  opinions  and  conclusions.  External 
impairments  to  independence  occur  when  an  auditor  is  deterred  from  acting  objectively  and 
exercising  professional  skepticism  by  pressures,  actual  or  perceived,  from  management  and 
employees  of  the  audited  entity  or  oversight  organizations.  For  example,  under  the  following 


‘^e  Office  of  Management  and  Budget  prohibits  an  auditor  who  prepared  the  entity’s  indirect  cost 
proposal  firom  conducting  the  required  audit  when  indirect  costs  recovered  by  the  entity  during  the 
prior  year  exceeded  $1  million. 
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conditions,  an  auditor  may  not  have  complete  freedom  to  make  an  independent  and  objective 
judgment  and  an  audit  may  be  adversely  affected: 

a.  external  interference  or  influence  that  could  improperly  or  imprudently  limit  or 
modify  the  scope  of  an  audit  or  threaten  to  do  so,  including  pressure  to  reduce 
inappropriately  the  extent  of  work  performed  in  order  to  reduce  costs  or  fees, 

b.  external  interference  with  the  selection  or  application  of  audit  procedures  or  in 
the  selection  of  transactions  to  be  examined, 

c.  unreasonable  restrictions  on  the  time  allowed  to  complete  an  audit  or  issue  the 
report, 

d.  interference  external  to  the  audit  organization  in  the  assignment,  appointment, 
and  promotion  of  audit  personnel, 

e.  restrictions  on  funds  or  other  resources  provided  to  the  audit  organization  that 
adversely  affect  the  audit  organization’s  ability  to  carry  out  its  responsibilities, 

f.  authority  to  overrule  or  to  inappropriately  influence  the  auditor’s  judgment  as  to 
the  appropriate  content  of  the  report, 

g.  threat  of  replacement  over  a  disagreement  with  the  contents  of  an  audit  report,  the 
auditor’s  conclusions  or  the  application  of  an  accounting  principle  or  other  criteria,  and 

h.  influences  that  jeopardize  the  auditor’s  continued  employment  for  reasons  other 
than  incompetence,  misconduct,  or  the  need  for  audit  services. 

3.28  An  audit  organization’s  internal  quality  control  system  for  compliance  with  GAGAS 
independence  requirements,  as  stated  in  paragraph  3.16,  should  include  internal  policies  and 
procedures  for  reporting  and  resolving  external  impairments. 

Organizational  Impairments 

3.29  In  addition  to  the  preceding  paragraphs  which  address  personal  and  external 
impairments,  government  audit  organization’s  capability  to  perform  the  work  and 
report  the  results  impartially  can  be  affected  by  their  place  within  government  and 
the  structure  of  the  government  entity  which  the  audit  organization  is  assigned  to 
audit.  Whether  performing  work  to  report  externally  to  third  parties  outside  the 
audited  entity  or  internally  to  top  management  within  the  audited  entity,  auditor 
organization  need  to  be  free  from  organizational  impairments  to  independence. 

Organizational  Impairment  Considerations 
When  Reporting  Externally  to  Third  Parties 

3.30  Government  auditors  can  be  presumed  to  be  free  from  organizational  impairments  to 
independence  when  reporting  externally  to  third  parties  if  their  audit  organization  is 
organizationally  independent  from  the  audited  entity.  Government  audit  organizations  can 
meet  the  requirement  for  organizational  independence  in  a  number  of  ways. 
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3.30.1  First,  a  government  audit  organization  may  be  presumed  to  be  free  from 
organizational  impairments  to  independence  from  the  audited  entity  to  report  externally,  if 
the  audit  organization  is 

a.  assigned  to  a  level  of  government  other  than  the  one  to  which  the  audited  entity  is 
assigned  (federal,  state,  or  local),  for  example,  a  federal  auditor  auditing  a  state  government 
program,  or 

b.  assigned  to  a  different  branch  of  government  within  the  same  level  of  government  as  the 
audited  entity;  for  example,  a  legislative  auditor  auditing  an  executive  branch  program. 

3.30.2  Second,  a  government  audit  organization  may  also  be  presumed  to  be  free  from 
organizational  impairments  for  external  reporting  if  the  audit  organization’s  head  meets  any 
of  the  following  criteria: 

a.  is  directly  elected  by  voters  of  the  jurisdiction  being  audited, 

b.  is  elected  or  appointed  by  a  legislative  body  subject  to  removal  by  a  legislative  body,  and 
reports  the  results  of  audits  to  and  is  accountable  to  a  legislative  body, 

c.  is  appointed  by  someone  other  than  a  legislative  body,  so  long  as  the  appointment  is 
confirmed  by  a  legislative  body  and  removal  from  the  position  is  subject  to  oversight  or 
approval  by  a  legislative  body,'^  and  reports  the  results  of  audits  to  and  is  accoimtable  to  a 
legislative  body,  or 

d.  is  appointed  by,  accountable  to,  reports  to,  and  can  only  be  removed  by  a  statutorily 
created  governing  body,  the  majority  of  whose  members  are  independently  elected  or 
appointed  and  come  from  outside  the  organization  being  audited. 

3.30.3  In  addition  to  the  presmnptive  criteria  in  paragraphs  3.30.1  and  3.30.2,  GAGAS 
recognize  that  there  may  be  other  organizational  structures  under  which  a  government  audit 
organization  could  be  considered  to  be  free  from  organizational  impairments,  and  thereby  be 
considered  organizationally  independent  to  report  externally.  These  other  structures  should 
provide  sufficient  safeguards  to  prevent  the  audited  entity  from  interfering  with  the  audit 
organization’s  ability  to  perform  the  work  and  report  the  results  impartially.  For  an  audit 
organization  to  be  considered  free  from  organizational  impairments  to  report  externally  under 
a  structure  different  from  the  ones  listed  in  paragraphs  3.30.1  and  3.30.2,  the  audit 
organization  should  have  all  of  the  following  safeguards: 

a.  statutory  protections  that  prevent  the  abolishment  of  the  audit  organization  by  the  audited 
entity. 


‘^Legislative  bodies  may  exercise  their  confirmation  powers  through  a  variety  of  means  as  long  as  they 
are  involved  in  the  approval  of  the  individual  to  head  the  audit  office.  This  involvement  can  be 
demonstrated  by  approving  the  individual  after  the  appointment  or  by  initially  selecting  or  nominating 
an  individual  or  in^viduals  for  appointment  by  the  appropriate  authority. 
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b.  statutory  protections  that  require  that  if  the  head  of  the  audit  organization  is  removed  from 
office,  the  head  of  the  agency  should  report  this  fact  and  the  reasons  for  the  removal  to  the 
legislative  body, 

c.  statutory  protections  that  prevent  the  audited  entity  from  interfering  with  the  initiation, 
scope,  timing,  and  completion  of  any  audit, 

d.  statutory  protections  that  prevent  the  audited  entity  from  interfering  with  the  reporting  on 
any  audit,  including  the  findings,  conclusions,  and  recommendations,  or  the  manner,  means, 
or  timing  of  the  audit  organization’s  reports, 

e.  statutory  protections  that  require  the  audit  organization  to  report  to  a  legislative  body  or 
other  independent  governing  body  on  a  recurring  basis, 

f.  statutory  protections  that  give  the  audit  organization  sole  authority  over  the  selection, 
retention,  advancement,  and  dismissal  of  its  staff,  and 

g.  statutory  access  to  records  and  documents  that  relate  to  the  agency,  program,  or  function 
being  audited. 

3.30.4  If  the  head  of  the  audit  organization  concludes  that  the  organization  meets  all  the 
safeguards  listed  in  paragraph  3.30.3,  the  audit  organization  should  be  considered  free  from 
organizational  impairments  to  independence  when  reporting  the  results  of  its  audits 
externally  to  third  parties.  The  audit  organization  should  document  the  statutory  provisions 
in  place  that  allow  it  to  meet  these  safeguards.  Those  provisions  should  be  reviewed  during 
the  external  quality  assurance  review  to  ensure  that  all  the  necessary  safeguards  have  been 
met. 


Organizational  Impairment  Considerations 
When  Reporting  Internally  to  Management 

3.30.5  Certain  federal,  state,  or  local  government  audit  organizations  or  audit  organizations 
within  other  government  entities,  such  as  public  colleges,  universities,  and  hospitals,  employ 
auditors  to  work  for  management  of  the  audited  entities.  These  auditors  may  be  subject  to 
administrative  direction  from  persons  involved  in  the  government  management  process. 

Such  audit  organizations  are  internal  audit  organizations.  A  government  internal  audit 
organization  can  be  presumed  to  be  free  from  organizational  impairments  to  independence 
when  reporting  internally  to  management  if  the  head  of  the  audit  organization  meets  all  of  the 
following  criteria: 

a.  is  accountable  to  the  head  or  deputy  head  of  the  government  entity, 

b.  is  required  to  report  the  results  of  the  audit  organization’s  work  to  the  head  or  deputy  head 
of  the  government  entity,  and 


‘‘‘statutory  authority  to  issue  a  subpoena  to  obtain  the  needed  records  is  one  way  to  meet  the 
requirement  for  access  to  records. 
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c.  is  located  organizationally  outside  the  staff  or  line  management  function  of  the  unit  under 
audit. 

3.30.6  If  the  conditions  of  paragraph  3.30.5  are  met,  the  audit  organization  should  be 
considered  free  of  organizational  impairments  to  independence  to  audit  internally  and  report 
objectively  to  the  entity’s  management.  Further  distribution  of  reports  outside  the 
organization  should  only  be  made  in  accordance  with  applicable  law,  rule,  regulation,  or 
policy.  In  these  situations,  the  fact  that  the  auditors  are  auditing  in  their  employing 
organizations  should  be  clearly  reflected  in  the  auditors’  reports. 

3.30.7  Auditors  need  to  be  sufficiently  removed  from  political  pressures  to  ensure  that  they 
can  conduct  their  audits  objectively  and  can  report  their  findings,  opinions,  and  conclusions 
objectively  without  fear  of  political  repercussions.  Whenever  feasible,  auditors  within 
internal  audit  organizations  should  be  xmder  a  personnel  system  in  which  compensation, 
training,  job  tenure,  and  advancement  are  based  on  merit. 

3.30.8  The  audit  organization’s  independence  is  enhanced  when  it  also  reports  regularly  to 
the  entity’s  independent  audit  committee  and/or  the  appropriate  government  oversight  body. 

3.30.9  When  internal  audit  organizations  that  are  free  of  organizational  impairments  to 
independence,  under  the  criteria  in  paragraph  3.30.5,  perform  audits  external  to  the 
government  entities  to  which  they  are  directly  assigned,  such  as  auditing  contractors  or 
outside  party  agreements,  and  no  personal  or  external  impairments  exist,  they  may  be 
considered  independent  of  the  audited  entities  and  free  to  report  objectively  to  the  heads  or 
deputy  heads  of  the  government  entities  to  which  they  are  assigned  and  to  parties  outside  the 
organizations  in  accordance  with  applicable  law,  rule,  regulation,  or  policy. 

3.30.10  The  audit  organization  should  document  the  conditions  in  place  that  allow  it  to  be 
considered  free  of  organizational  impairments  to  independence  to  report  internally.  Those 
conditions  should  be  reviewed  during  the  peer  review  to  ensure  that  all  the  necessary 
safeguards  have  been  met. 
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